Who this checklist is for
Operators comparing three to five casino software providers or sportsbook vendors, and affiliates buying a platform for the first time. Three checks settle most shortlists before anyone looks at a feature list. First, the provider's licences and supplier certificates, confirmed in the regulator's own register for every market you plan to enter. Second, test-lab certificates that name the entity you will contract with and the version you will run. Third, contract terms on data, exit, code, service levels and money that you can enforce.
Run the same checks on us. A provider that cannot give you a licence number, a certificate reference and a draft contract before the commercial call has already answered. If you have not yet chosen between white label, turnkey and owning the platform, settle that first in casino launch models compared, because the model changes which of these checks apply to you.
Step 1: licences the provider holds, checked at source
Get in writing the legal entity you will contract with, each licence number and the issuing regulator, then look them up yourself. A logo on a slide is not evidence, and neither is a PDF certificate, because copies can be outdated or altered. Anjouan's regulator says certificates that cannot be verified in its register should not be relied on.
Supplier licensing is becoming a condition of doing business. Since 1 July 2025 every B2B supplier serving an Anjouan-licensed operator, from platform providers to RNG and game suppliers, has needed an Anjouan B2B licence or a Recognition Certificate. In Finland, software licence applications open on 1 July 2027, and from 1 July 2028 licensed operators may run only software from licensed providers. A provider without the right supplier status cannot legally serve your brand in those markets, whatever its sales team says.
| Where the licence is | Where to check | What a genuine entry shows | Watch for |
|---|---|---|---|
| Great Britain | Gambling Commission public register | The business, its licences and its domains, listed as active, inactive or white label | A brand that appears under a different licensee from the one named in the pitch |
| Malta | MGA licensee register and its URL checker | Holder, company number, licence number and status | A group company licensed, but not the entity on your contract |
| Isle of Man | GSC online gambling licensee register | Licence type (Full, Network Services or Software Supply), status, websites | Status other than active; the GSC listed a suspension dated 2 October 2026 |
| Anjouan | Anjouan Gaming public register: Verify a Licence, and the Recognition Letter Register | Holder, number, B2C or B2B type, status, approved domains; the certificate's QR code opens the same entry | A supplier with no B2B licence or recognition entry |
| Curaçao | The CGA seal on the domain, linking to cert.cga.cw; the CGA itself | A green seal that opens a certificate on the regulator's own domain | An orange seal, which has put the operator in breach of Curaçao law since 15 October 2025 |
Curaçao needs a caveat this month. The CGA's licensing portal went offline after a data breach and, by its notice of 7 October 2026, will not return. The regulator says existing licences remain valid, that the digital seal will be affected, and that an alternative way of showing a domain is licensed is coming. Until it arrives, ask for the licence number and confirm it with the CGA directly.
The "sublicence" claim and how to test it
A provider offering to launch you "under our sublicence" is making a claim you can check. In Curaçao the answer is already settled: the LOK came into force on 24 December 2024 and replaced the master-licence and sub-licence model with direct licences from the CGA. A Curaçao sublicence sold today has no basis under the LOK, whatever the contract calls it.
Elsewhere the word can be genuine. The Isle of Man issues real sub-licences under OGRA, tied to one fully licensed platform at a time. So test the register entry, not the word:
- Ask for the name of the licence holder and its licence number.
- Find that holder in the regulator's register and confirm the licence is active and covers casino or betting, as you need.
- Check that existing brands on the same arrangement appear under that holder. In Great Britain the register lists white label domains under the licensee that answers for them, and our licence tracker shows which licence holders carry white label brands and how many.
- If nothing shows up, treat it as unlicensed. The Gambling Commission states that responsibility for a white label site rests with the licence holder and cannot be transferred, which means a brand with no visible licence holder has nobody answering for it.
Step 2: test-lab certificates
RNG, game and platform certificates come from labs such as GLI, BMM, iTech Labs and eCOGRA. GLI's certification database is password-protected for suppliers and regulators, so you usually cannot look a certificate up yourself. Ask the lab or the regulator to confirm it. On the certificate, check four things: the legal entity, the game or platform version, the jurisdiction or technical standard, and the date. A certificate for last year's build, or one issued to a sister company, is not one for the platform you are buying.
Check the lab as well as the certificate. Curaçao recognises only test houses accredited to ISO/IEC 17025 by an ILAC-signatory body, with a scope that covers the testing they sign off. Two other certificates belong in the file. An ISO 27001 certificate can be checked on IAF CertSearch, which shows whether it is active, suspended, withdrawn or expired. A PCI DSS claim for anything that touches card data should appear on Visa's Global Registry of Service Providers. That listing is revalidated every 12 months and is a snapshot of one assessment, not a guarantee.
Step 3: references that can be checked
Ask for operators of your size in your markets, not the provider's largest client, and find the reference's brand in the register under the licence you were told it uses. On the call, ask about the last serious outage and how long it took to hear from the provider, how disputed revenue-share invoices were settled, and whether anyone has left and received their data.
Step 4: the contract terms that decide the next five years
| Term | What to get in writing | Red flag |
|---|---|---|
| Data ownership | Who owns player, transaction and bonus data, and your right to a full export at any time, not only on exit | Data "available on request" with no format or deadline |
| Exit | Notice period, transition assistance, keeping the brand live while you move, what is handed over and when | Exit fees or minimum terms that run on after notice |
| Source-code escrow | Named release triggers, usually insolvency or a material failure to maintain the software; a fresh deposit after each release; a verification test that compiles the deposit | An escrow agreement with a single deposit made at signing |
| Service levels | How availability is defined and measured, response and fix times by severity, service credits, and what is excluded | An uptime figure with no measurement point and no credit attached |
| Revenue share | Whether the base is GGR or NGR, and every deduction allowed before the share is applied: bonuses, game-provider fees, payment fees, taxes; tiers; any monthly minimum | "Net revenue" left undefined |
| Reserve | Who holds the rolling reserve, the percentage, the release schedule and what happens to it on exit; see payments | A reserve with no release date |
| Change of control | Your right to terminate if the provider is sold, and the escrow trigger if it is | Silence on assignment of the contract |
Red flags, in one list
- A licence or sublicence you cannot find in any regulator's register.
- A certificate issued to a different entity or an older version of the product.
- No draft contract before the commercial negotiation.
- Player data that belongs to the provider with no export clause.
- A guaranteed licence approval. Regulators decide; nobody can promise the outcome.
- References that cannot be matched to a register entry.
When this checklist is more than you need
If you are buying a single module, such as a sports betting API for an existing licensed platform, steps 2 and 4 still apply in full. Step 1 shrinks to confirming the supplier's status in your own regulator's register, and step 3 to one reference in your market.
Frequently asked
What is the difference between a B2B and a B2C licence?
A B2C licence lets a company take bets from players. A B2B licence, or a supplier recognition such as Anjouan's, lets a company supply platforms, games or RNGs to licensed operators. A platform provider needs the second; it needs the first only if it runs brands itself.
Is a lab certificate enough on its own?
No. It proves one version of one product was tested to one standard. Ask whether the lab is accepted by your regulator, and whether the build you will run is the build that was tested.
Should I insist on source-code escrow?
For a platform your business cannot run without, yes, unless you own the code outright. Providers often resist escrow for off-the-shelf software, so negotiate it with the main contract, not afterwards.
How often should I re-check a provider?
At least once a year, and again after a change of ownership, a new market or a regulatory change. Licences get suspended, and the register is where you see it first.